1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096 |
- #include "sdk_common.h"
- #if NRF_MODULE_ENABLED(PEER_MANAGER)
- #include "security_dispatcher.h"
- #include <string.h>
- #include "ble.h"
- #include "ble_gap.h"
- #include "ble_err.h"
- #include "ble_conn_state.h"
- #include "peer_manager_types.h"
- #include "peer_data_storage.h"
- #include "peer_database.h"
- #include "id_manager.h"
- #if PM_RA_PROTECTION_ENABLED
- #include "auth_status_tracker.h"
- #endif
- #define NRF_LOG_MODULE_NAME peer_manager_smd
- #if PM_LOG_ENABLED
- #define NRF_LOG_LEVEL PM_LOG_LEVEL
- #define NRF_LOG_INFO_COLOR PM_LOG_INFO_COLOR
- #define NRF_LOG_DEBUG_COLOR PM_LOG_DEBUG_COLOR
- #else
- #define NRF_LOG_LEVEL 0
- #endif
- #include "nrf_log.h"
- #include "nrf_log_ctrl.h"
- NRF_LOG_MODULE_REGISTER();
- #include "nrf_strerror.h"
- #ifndef PM_CENTRAL_ENABLED
- #define PM_CENTRAL_ENABLED 1
- #endif
- #define SMD_EVENT_HANDLERS_CNT (sizeof(m_evt_handlers) / sizeof(m_evt_handlers[0]))
- STATIC_ASSERT((NRF_SDH_BLE_CENTRAL_LINK_COUNT == 0) || PM_CENTRAL_ENABLED,
- "Peer Manager Central operation must be enabled when using central links.");
- extern void sm_smd_evt_handler(pm_evt_t * p_event);
- static pm_evt_handler_internal_t const m_evt_handlers[] =
- {
- sm_smd_evt_handler
- };
- static bool m_module_initialized;
- static ble_conn_state_user_flag_id_t m_flag_sec_proc = BLE_CONN_STATE_USER_FLAG_INVALID;
- static ble_conn_state_user_flag_id_t m_flag_sec_proc_pairing = BLE_CONN_STATE_USER_FLAG_INVALID;
- static ble_conn_state_user_flag_id_t m_flag_sec_proc_bonding = BLE_CONN_STATE_USER_FLAG_INVALID;
- static ble_conn_state_user_flag_id_t m_flag_allow_repairing = BLE_CONN_STATE_USER_FLAG_INVALID;
- static ble_gap_lesc_p256_pk_t m_peer_pk;
- static __INLINE bool sec_procedure(uint16_t conn_handle)
- {
- return ble_conn_state_user_flag_get(conn_handle, m_flag_sec_proc);
- }
- static __INLINE bool pairing(uint16_t conn_handle)
- {
- return ble_conn_state_user_flag_get(conn_handle, m_flag_sec_proc_pairing);
- }
- static __INLINE bool bonding(uint16_t conn_handle)
- {
- return ble_conn_state_user_flag_get(conn_handle, m_flag_sec_proc_bonding);
- }
- static __INLINE bool allow_repairing(uint16_t conn_handle)
- {
- return ble_conn_state_user_flag_get(conn_handle, m_flag_allow_repairing);
- }
- static void evt_send(pm_evt_t * p_event)
- {
- p_event->peer_id = im_peer_id_get_by_conn_handle(p_event->conn_handle);
- for (uint32_t i = 0; i < SMD_EVENT_HANDLERS_CNT; i++)
- {
- m_evt_handlers[i](p_event);
- }
- }
- static void sec_start_send(uint16_t conn_handle,
- pm_conn_sec_procedure_t procedure)
- {
- pm_evt_t evt =
- {
- .evt_id = PM_EVT_CONN_SEC_START,
- .conn_handle = conn_handle,
- .params = {.conn_sec_start = {.procedure = procedure}}
- };
- evt_send(&evt);
- }
- static void send_unexpected_error(uint16_t conn_handle, ret_code_t err_code)
- {
- pm_evt_t error_evt =
- {
- .evt_id = PM_EVT_ERROR_UNEXPECTED,
- .conn_handle = conn_handle,
- .params =
- {
- .error_unexpected =
- {
- .error = err_code,
- }
- }
- };
- evt_send(&error_evt);
- }
- static void send_storage_full_evt(uint16_t conn_handle)
- {
- pm_evt_t evt =
- {
- .evt_id = PM_EVT_STORAGE_FULL,
- .conn_handle = conn_handle
- };
- evt_send(&evt);
- }
- static void conn_sec_failure(uint16_t conn_handle,
- pm_conn_sec_procedure_t procedure,
- pm_sec_error_code_t error,
- uint8_t error_src)
- {
- pm_evt_t evt =
- {
- .evt_id = PM_EVT_CONN_SEC_FAILED,
- .conn_handle = conn_handle,
- .params =
- {
- .conn_sec_failed =
- {
- .procedure = procedure,
- .error = error,
- .error_src = error_src,
- }
- }
- };
- ble_conn_state_user_flag_set(conn_handle, m_flag_sec_proc, false);
- evt_send(&evt);
- return;
- }
- static void pairing_failure(uint16_t conn_handle,
- pm_sec_error_code_t error,
- uint8_t error_src)
- {
- ret_code_t err_code = NRF_SUCCESS;
- pm_conn_sec_procedure_t procedure = bonding(conn_handle) ? PM_CONN_SEC_PROCEDURE_BONDING
- : PM_CONN_SEC_PROCEDURE_PAIRING;
- err_code = pdb_write_buf_release(PDB_TEMP_PEER_ID(conn_handle), PM_PEER_DATA_ID_BONDING);
- if ((err_code != NRF_SUCCESS) && (err_code != NRF_ERROR_NOT_FOUND ))
- {
- NRF_LOG_ERROR("Could not clean up after failed bonding procedure. "\
- "pdb_write_buf_release() returned %s. conn_handle: %d.",
- nrf_strerror_get(err_code),
- conn_handle);
- send_unexpected_error(conn_handle, err_code);
- }
- conn_sec_failure(conn_handle, procedure, error, error_src);
- return;
- }
- static __INLINE void encryption_failure(uint16_t conn_handle,
- pm_sec_error_code_t error,
- uint8_t error_src)
- {
- conn_sec_failure(conn_handle, PM_CONN_SEC_PROCEDURE_ENCRYPTION, error, error_src);
- return;
- }
- static void link_secure_failure(uint16_t conn_handle,
- pm_sec_error_code_t error,
- uint8_t error_src)
- {
- if (sec_procedure(conn_handle))
- {
- if (pairing(conn_handle))
- {
- pairing_failure(conn_handle, error, error_src);
- }
- else
- {
- encryption_failure(conn_handle, error, error_src);
- }
- }
- }
- static void sec_proc_start(uint16_t conn_handle,
- bool success,
- pm_conn_sec_procedure_t procedure)
- {
- ble_conn_state_user_flag_set(conn_handle, m_flag_sec_proc, success);
- if (success)
- {
- ble_conn_state_user_flag_set(conn_handle,
- m_flag_sec_proc_pairing,
- (procedure != PM_CONN_SEC_PROCEDURE_ENCRYPTION));
- ble_conn_state_user_flag_set(conn_handle,
- m_flag_sec_proc_bonding,
- (procedure == PM_CONN_SEC_PROCEDURE_BONDING));
- sec_start_send(conn_handle, procedure);
- }
- }
- #ifdef BLE_GAP_ROLE_PERIPH
- static void sec_info_request_process(ble_gap_evt_t const * p_gap_evt)
- {
- ret_code_t err_code;
- ble_gap_enc_info_t const * p_enc_info = NULL;
- pm_peer_data_flash_t peer_data;
- pm_peer_id_t peer_id = im_peer_id_get_by_master_id(
- &p_gap_evt->params.sec_info_request.master_id);
- if (peer_id == PM_PEER_ID_INVALID)
- {
- peer_id = im_peer_id_get_by_conn_handle(p_gap_evt->conn_handle);
- }
- else
- {
-
-
- im_new_peer_id(p_gap_evt->conn_handle, peer_id);
- }
- sec_proc_start(p_gap_evt->conn_handle, true, PM_CONN_SEC_PROCEDURE_ENCRYPTION);
- if (peer_id != PM_PEER_ID_INVALID)
- {
- err_code = pdb_peer_data_ptr_get(peer_id, PM_PEER_DATA_ID_BONDING, &peer_data);
- if (err_code == NRF_SUCCESS)
- {
-
- ble_gap_enc_key_t const * p_existing_key = &peer_data.p_bonding_data->own_ltk;
- if (p_gap_evt->params.sec_info_request.enc_info
- && (p_existing_key->enc_info.lesc
- || im_master_ids_compare(&p_existing_key->master_id,
- &p_gap_evt->params.sec_info_request.master_id)))
- {
- p_enc_info = &p_existing_key->enc_info;
- }
- }
- }
- err_code = sd_ble_gap_sec_info_reply(p_gap_evt->conn_handle, p_enc_info, NULL, NULL);
- if (err_code == NRF_ERROR_INVALID_STATE)
- {
-
-
-
-
- NRF_LOG_WARNING("sd_ble_gap_sec_info_reply() returned NRF_EROR_INVALID_STATE, which is an"\
- "error unless the link is disconnecting.");
- }
- else if (err_code != NRF_SUCCESS)
- {
- NRF_LOG_ERROR("Could not complete encryption procedure. sd_ble_gap_sec_info_reply() "\
- "returned %s. conn_handle: %d, peer_id: %d.",
- nrf_strerror_get(err_code),
- p_gap_evt->conn_handle,
- peer_id);
- send_unexpected_error(p_gap_evt->conn_handle, err_code);
- }
- else if (p_gap_evt->params.sec_info_request.enc_info && (p_enc_info == NULL))
- {
- encryption_failure(p_gap_evt->conn_handle,
- PM_CONN_SEC_ERROR_PIN_OR_KEY_MISSING,
- BLE_GAP_SEC_STATUS_SOURCE_LOCAL);
- }
- return;
- }
- #endif
- static void send_config_req(uint16_t conn_handle)
- {
- pm_evt_t evt;
- memset(&evt, 0, sizeof(evt));
- evt.evt_id = PM_EVT_CONN_SEC_CONFIG_REQ;
- evt.conn_handle = conn_handle;
- evt_send(&evt);
- }
- void smd_conn_sec_config_reply(uint16_t conn_handle, pm_conn_sec_config_t * p_conn_sec_config)
- {
- NRF_PM_DEBUG_CHECK(m_module_initialized);
- NRF_PM_DEBUG_CHECK(p_conn_sec_config != NULL);
- ble_conn_state_user_flag_set(conn_handle,
- m_flag_allow_repairing,
- p_conn_sec_config->allow_repairing);
- }
- static void disconnect_process(ble_gap_evt_t const * p_gap_evt)
- {
- pm_sec_error_code_t error = (p_gap_evt->params.disconnected.reason
- == BLE_HCI_CONN_TERMINATED_DUE_TO_MIC_FAILURE)
- ? PM_CONN_SEC_ERROR_MIC_FAILURE : PM_CONN_SEC_ERROR_DISCONNECT;
- link_secure_failure(p_gap_evt->conn_handle, error, BLE_GAP_SEC_STATUS_SOURCE_LOCAL);
- }
- static void send_params_req(uint16_t conn_handle, ble_gap_sec_params_t const * p_peer_params)
- {
- pm_evt_t evt =
- {
- .evt_id = PM_EVT_CONN_SEC_PARAMS_REQ,
- .conn_handle = conn_handle,
- .params =
- {
- .conn_sec_params_req =
- {
- .p_peer_params = p_peer_params
- },
- },
- };
- evt_send(&evt);
- }
- static void sec_params_request_process(ble_gap_evt_t const * p_gap_evt)
- {
- #ifdef BLE_GAP_ROLE_PERIPH
- if (ble_conn_state_role(p_gap_evt->conn_handle) == BLE_GAP_ROLE_PERIPH)
- {
- sec_proc_start(p_gap_evt->conn_handle,
- true,
- p_gap_evt->params.sec_params_request.peer_params.bond
- ? PM_CONN_SEC_PROCEDURE_BONDING
- : PM_CONN_SEC_PROCEDURE_PAIRING);
- }
- #endif
- send_params_req(p_gap_evt->conn_handle, &p_gap_evt->params.sec_params_request.peer_params);
- return;
- }
- static void pairing_success_evt_send(ble_gap_evt_t const * p_gap_evt, bool data_stored)
- {
- pm_evt_t pairing_success_evt;
- pairing_success_evt.evt_id = PM_EVT_CONN_SEC_SUCCEEDED;
- pairing_success_evt.conn_handle = p_gap_evt->conn_handle;
- pairing_success_evt.params.conn_sec_succeeded.procedure = p_gap_evt->params.auth_status.bonded
- ? PM_CONN_SEC_PROCEDURE_BONDING
- : PM_CONN_SEC_PROCEDURE_PAIRING;
- pairing_success_evt.params.conn_sec_succeeded.data_stored = data_stored;
- evt_send(&pairing_success_evt);
- }
- static void auth_status_success_process(ble_gap_evt_t const * p_gap_evt)
- {
- ret_code_t err_code;
- uint16_t conn_handle = p_gap_evt->conn_handle;
- pm_peer_id_t peer_id;
- pm_peer_data_t peer_data;
- bool new_peer_id = false;
- ble_conn_state_user_flag_set(conn_handle, m_flag_sec_proc, false);
- if (!p_gap_evt->params.auth_status.bonded)
- {
- pairing_success_evt_send(p_gap_evt, false);
- return;
- }
- err_code = pdb_write_buf_get(PDB_TEMP_PEER_ID(conn_handle), PM_PEER_DATA_ID_BONDING, 1, &peer_data);
- if (err_code != NRF_SUCCESS)
- {
- NRF_LOG_ERROR("RAM buffer for new bond was unavailable. pdb_write_buf_get() returned %s. conn_handle: %d.",
- nrf_strerror_get(err_code),
- conn_handle);
- send_unexpected_error(conn_handle, err_code);
- pairing_success_evt_send(p_gap_evt, false);
- return;
- }
- peer_id = im_peer_id_get_by_conn_handle(conn_handle);
- if (peer_id == PM_PEER_ID_INVALID)
- {
- peer_id = im_find_duplicate_bonding_data(peer_data.p_bonding_data, PM_PEER_ID_INVALID);
- if (peer_id != PM_PEER_ID_INVALID)
- {
-
- im_new_peer_id(conn_handle, peer_id);
-
- if (!allow_repairing(conn_handle))
- {
- send_config_req(conn_handle);
- if (!allow_repairing(conn_handle))
- {
- pairing_success_evt_send(p_gap_evt, false);
- return;
- }
- }
- }
- }
- if (peer_id == PM_PEER_ID_INVALID)
- {
- peer_id = pds_peer_id_allocate();
- if (peer_id == PM_PEER_ID_INVALID)
- {
- NRF_LOG_ERROR("Could not allocate new peer_id for incoming bond.");
- send_unexpected_error(conn_handle, NRF_ERROR_NO_MEM);
- pairing_success_evt_send(p_gap_evt, false);
- return;
- }
- im_new_peer_id(conn_handle, peer_id);
- new_peer_id = true;
- }
- err_code = pdb_write_buf_store(PDB_TEMP_PEER_ID(conn_handle), PM_PEER_DATA_ID_BONDING, peer_id);
- if (err_code == NRF_SUCCESS)
- {
- pairing_success_evt_send(p_gap_evt, true);
- }
- else if (err_code == NRF_ERROR_STORAGE_FULL)
- {
- send_storage_full_evt(conn_handle);
- pairing_success_evt_send(p_gap_evt, true);
- }
- else
- {
-
- NRF_LOG_ERROR("Could not store bond. pdb_write_buf_store() returned %s. "\
- "conn_handle: %d, peer_id: %d",
- nrf_strerror_get(err_code),
- conn_handle,
- peer_id);
- send_unexpected_error(conn_handle, err_code);
- pairing_success_evt_send(p_gap_evt, false);
- if (new_peer_id)
- {
- UNUSED_RETURN_VALUE(im_peer_free(peer_id));
- }
- }
- return;
- }
- static void auth_status_failure_process(ble_gap_evt_t const * p_gap_evt)
- {
- link_secure_failure(p_gap_evt->conn_handle,
- p_gap_evt->params.auth_status.auth_status,
- p_gap_evt->params.auth_status.error_src);
- }
- static void auth_status_process(ble_gap_evt_t const * p_gap_evt)
- {
- switch (p_gap_evt->params.auth_status.auth_status)
- {
- case BLE_GAP_SEC_STATUS_SUCCESS:
- auth_status_success_process(p_gap_evt);
- break;
- default:
- auth_status_failure_process(p_gap_evt);
- #if PM_RA_PROTECTION_ENABLED
- ast_auth_error_notify(p_gap_evt->conn_handle);
- #endif
- break;
- }
- }
- static void conn_sec_update_process(ble_gap_evt_t const * p_gap_evt)
- {
- if (!pairing(p_gap_evt->conn_handle))
- {
-
- if (!ble_conn_state_encrypted(p_gap_evt->conn_handle))
- {
- encryption_failure(p_gap_evt->conn_handle,
- PM_CONN_SEC_ERROR_PIN_OR_KEY_MISSING,
- BLE_GAP_SEC_STATUS_SOURCE_REMOTE);
- }
- else
- {
- ble_conn_state_user_flag_set(p_gap_evt->conn_handle, m_flag_sec_proc, false);
- pm_evt_t evt;
- evt.evt_id = PM_EVT_CONN_SEC_SUCCEEDED;
- evt.conn_handle = p_gap_evt->conn_handle;
- evt.params.conn_sec_succeeded.procedure = PM_CONN_SEC_PROCEDURE_ENCRYPTION;
- evt.params.conn_sec_succeeded.data_stored = false;
- evt_send(&evt);
- }
- }
- }
- static void flag_id_init(ble_conn_state_user_flag_id_t * p_flag_id)
- {
- if (*p_flag_id == BLE_CONN_STATE_USER_FLAG_INVALID)
- {
- *p_flag_id = ble_conn_state_user_flag_acquire();
- }
- }
- ret_code_t smd_init(void)
- {
- NRF_PM_DEBUG_CHECK(!m_module_initialized);
- flag_id_init(&m_flag_sec_proc);
- flag_id_init(&m_flag_sec_proc_pairing);
- flag_id_init(&m_flag_sec_proc_bonding);
- flag_id_init(&m_flag_allow_repairing);
- if ((m_flag_sec_proc == BLE_CONN_STATE_USER_FLAG_INVALID) ||
- (m_flag_sec_proc_pairing == BLE_CONN_STATE_USER_FLAG_INVALID) ||
- (m_flag_sec_proc_bonding == BLE_CONN_STATE_USER_FLAG_INVALID) ||
- (m_flag_allow_repairing == BLE_CONN_STATE_USER_FLAG_INVALID))
- {
- NRF_LOG_ERROR("Could not acquire conn_state user flags. Increase "\
- "BLE_CONN_STATE_USER_FLAG_COUNT in the ble_conn_state module.");
- return NRF_ERROR_INTERNAL;
- }
- #if PM_RA_PROTECTION_ENABLED
- ret_code_t err_code = ast_init();
- if (err_code != NRF_SUCCESS)
- {
- return err_code;
- }
- #endif
- m_module_initialized = true;
- return NRF_SUCCESS;
- }
- static ret_code_t sec_keyset_fill(uint16_t conn_handle,
- uint8_t role,
- ble_gap_lesc_p256_pk_t * p_public_key,
- ble_gap_sec_keyset_t * p_sec_keyset)
- {
- ret_code_t err_code;
- pm_peer_data_t peer_data;
- if (p_sec_keyset == NULL)
- {
- NRF_LOG_ERROR("Internal error: %s received NULL for p_sec_keyset.", __func__);
- return NRF_ERROR_INTERNAL;
- }
-
- err_code = pdb_write_buf_get(PDB_TEMP_PEER_ID(conn_handle), PM_PEER_DATA_ID_BONDING, 1, &peer_data);
- if (err_code == NRF_ERROR_BUSY)
- {
-
- }
- else if (err_code != NRF_SUCCESS)
- {
- NRF_LOG_ERROR("Could not retrieve RAM buffer for incoming bond. pdb_write_buf_get() "\
- "returned %s. conn_handle: %d",
- nrf_strerror_get(err_code),
- conn_handle);
- err_code = NRF_ERROR_INTERNAL;
- }
- else
- {
- memset(peer_data.p_bonding_data, 0, sizeof(pm_peer_data_bonding_t));
- peer_data.p_bonding_data->own_role = role;
- p_sec_keyset->keys_own.p_enc_key = &peer_data.p_bonding_data->own_ltk;
- p_sec_keyset->keys_own.p_pk = p_public_key;
- p_sec_keyset->keys_peer.p_enc_key = &peer_data.p_bonding_data->peer_ltk;
- p_sec_keyset->keys_peer.p_id_key = &peer_data.p_bonding_data->peer_ble_id;
- p_sec_keyset->keys_peer.p_pk = &m_peer_pk;
-
-
- err_code = im_ble_addr_get(conn_handle, &peer_data.p_bonding_data->peer_ble_id.id_addr_info);
- if (err_code != NRF_SUCCESS)
- {
- NRF_LOG_WARNING("im_ble_addr_get() returned %s. conn_handle: %d. Link was likely disconnected.",
- nrf_strerror_get(err_code),
- conn_handle);
- return NRF_ERROR_INVALID_STATE;
- }
- }
- return err_code;
- }
- ret_code_t smd_params_reply(uint16_t conn_handle,
- ble_gap_sec_params_t * p_sec_params,
- ble_gap_lesc_p256_pk_t * p_public_key)
- {
- NRF_PM_DEBUG_CHECK(m_module_initialized);
- uint8_t role = ble_conn_state_role(conn_handle);
- ret_code_t err_code = NRF_SUCCESS;
- uint8_t sec_status = BLE_GAP_SEC_STATUS_SUCCESS;
- ble_gap_sec_keyset_t sec_keyset;
- memset(&sec_keyset, 0, sizeof(ble_gap_sec_keyset_t));
- #ifdef BLE_GAP_ROLE_PERIPH
- if (role == BLE_GAP_ROLE_PERIPH)
- {
-
- ble_conn_state_user_flag_set(conn_handle, m_flag_allow_repairing, false);
- }
- #endif
- if (role == BLE_GAP_ROLE_INVALID)
- {
- return BLE_ERROR_INVALID_CONN_HANDLE;
- }
- #if PM_RA_PROTECTION_ENABLED
- if (ast_peer_blacklisted(conn_handle))
- {
- sec_status = BLE_GAP_SEC_STATUS_REPEATED_ATTEMPTS;
- }
- else
- #endif
- if (p_sec_params == NULL)
- {
-
- sec_status = BLE_GAP_SEC_STATUS_PAIRING_NOT_SUPP;
- }
- else
- {
- #ifdef BLE_GAP_ROLE_PERIPH
- if ((im_peer_id_get_by_conn_handle(conn_handle) != PM_PEER_ID_INVALID) &&
- (role == BLE_GAP_ROLE_PERIPH) &&
- !allow_repairing(conn_handle))
- {
-
- send_config_req(conn_handle);
- if (!allow_repairing(conn_handle))
- {
-
- sec_status = BLE_GAP_SEC_STATUS_PAIRING_NOT_SUPP;
- }
- }
- #endif
- if (!p_sec_params->bond)
- {
-
- sec_keyset.keys_own.p_pk = p_public_key;
- sec_keyset.keys_peer.p_pk = &m_peer_pk;
- }
- else if (sec_status != BLE_GAP_SEC_STATUS_PAIRING_NOT_SUPP)
- {
-
- err_code = sec_keyset_fill(conn_handle, role, p_public_key, &sec_keyset);
- }
- }
- if (err_code == NRF_SUCCESS)
- {
-
-
- ble_gap_sec_params_t * p_aux_sec_params = NULL;
- #ifdef BLE_GAP_ROLE_PERIPH
- p_aux_sec_params = (role == BLE_GAP_ROLE_PERIPH) ? p_sec_params : NULL;
- #endif
- err_code = sd_ble_gap_sec_params_reply(conn_handle, sec_status, p_aux_sec_params, &sec_keyset);
- }
- return err_code;
- }
- static ret_code_t link_secure_authenticate(uint16_t conn_handle,
- ble_gap_sec_params_t * p_sec_params)
- {
- ret_code_t err_code = sd_ble_gap_authenticate(conn_handle, p_sec_params);
- if (err_code == NRF_ERROR_NO_MEM)
- {
-
- err_code = NRF_ERROR_BUSY;
- }
- return err_code;
- }
- #if PM_CENTRAL_ENABLED
- static ret_code_t link_secure_central_encryption(uint16_t conn_handle,
- pm_peer_id_t peer_id)
- {
- pm_peer_data_flash_t peer_data;
- ret_code_t err_code;
- ble_gap_enc_key_t const * p_existing_key = NULL;
- bool lesc = false;
- err_code = pdb_peer_data_ptr_get(peer_id, PM_PEER_DATA_ID_BONDING, &peer_data);
- if (err_code == NRF_SUCCESS)
- {
-
- p_existing_key = &(peer_data.p_bonding_data->peer_ltk);
- lesc = peer_data.p_bonding_data->own_ltk.enc_info.lesc;
- if (lesc)
- {
-
- p_existing_key = &(peer_data.p_bonding_data->own_ltk);
- }
- }
- if ((err_code != NRF_SUCCESS) && (err_code != NRF_ERROR_NOT_FOUND))
- {
- if (err_code != NRF_ERROR_BUSY)
- {
- NRF_LOG_ERROR("Could not retrieve stored bond. pdb_peer_data_ptr_get() returned %s. "\
- "peer_id: %d",
- nrf_strerror_get(err_code),
- peer_id);
- err_code = NRF_ERROR_INTERNAL;
- }
- }
- else if (p_existing_key == NULL)
- {
- err_code = NRF_ERROR_BUSY;
- }
- else if (!lesc && !im_master_id_is_valid(&(p_existing_key->master_id)))
- {
-
- err_code = NRF_ERROR_INVALID_DATA;
- }
- else
- {
-
- err_code = sd_ble_gap_encrypt(conn_handle,
- &(p_existing_key->master_id),
- &(p_existing_key->enc_info));
- }
- sec_proc_start(conn_handle, err_code == NRF_SUCCESS, PM_CONN_SEC_PROCEDURE_ENCRYPTION);
- return err_code;
- }
- static ret_code_t link_secure_central(uint16_t conn_handle,
- ble_gap_sec_params_t * p_sec_params,
- bool force_repairing)
- {
- ret_code_t err_code;
- pm_peer_id_t peer_id;
- if (p_sec_params == NULL)
- {
- return link_secure_authenticate(conn_handle, NULL);
- }
-
- ble_conn_state_user_flag_set(conn_handle, m_flag_allow_repairing, force_repairing);
- peer_id = im_peer_id_get_by_conn_handle(conn_handle);
- if ((peer_id != PM_PEER_ID_INVALID) && !force_repairing)
- {
-
-
- err_code = link_secure_central_encryption(conn_handle, peer_id);
- }
- else
- {
-
-
- err_code = link_secure_authenticate(conn_handle, p_sec_params);
- pm_conn_sec_procedure_t procedure = (p_sec_params && p_sec_params->bond) ?
- PM_CONN_SEC_PROCEDURE_BONDING :
- PM_CONN_SEC_PROCEDURE_PAIRING;
- sec_proc_start(conn_handle, err_code == NRF_SUCCESS, procedure);
- }
- return err_code;
- }
- static void sec_request_process(ble_gap_evt_t const * p_gap_evt)
- {
- if (sec_procedure(p_gap_evt->conn_handle))
- {
-
- return;
- }
- pm_evt_t evt =
- {
- .evt_id = PM_EVT_SLAVE_SECURITY_REQ,
- .conn_handle = p_gap_evt->conn_handle
- };
- memcpy(&evt.params.slave_security_req, &p_gap_evt->params.sec_request, sizeof(ble_gap_evt_sec_request_t));
- evt_send(&evt);
- return;
- }
- #endif
- #ifdef BLE_GAP_ROLE_PERIPH
- static ret_code_t link_secure_peripheral(uint16_t conn_handle, ble_gap_sec_params_t * p_sec_params)
- {
- ret_code_t err_code = NRF_SUCCESS;
- if (p_sec_params != NULL)
- {
- err_code = link_secure_authenticate(conn_handle, p_sec_params);
- }
- return err_code;
- }
- #endif
- ret_code_t smd_link_secure(uint16_t conn_handle,
- ble_gap_sec_params_t * p_sec_params,
- bool force_repairing)
- {
- NRF_PM_DEBUG_CHECK(m_module_initialized);
- uint8_t role = ble_conn_state_role(conn_handle);
- switch (role)
- {
- #if PM_CENTRAL_ENABLED
- case BLE_GAP_ROLE_CENTRAL:
- return link_secure_central(conn_handle, p_sec_params, force_repairing);
- #endif
- #ifdef BLE_GAP_ROLE_PERIPH
- case BLE_GAP_ROLE_PERIPH:
- return link_secure_peripheral(conn_handle, p_sec_params);
- #endif
- default:
- return BLE_ERROR_INVALID_CONN_HANDLE;
- }
- }
- void smd_ble_evt_handler(ble_evt_t const * p_ble_evt)
- {
- switch (p_ble_evt->header.evt_id)
- {
- case BLE_GAP_EVT_DISCONNECTED:
- disconnect_process(&(p_ble_evt->evt.gap_evt));
- break;
- case BLE_GAP_EVT_SEC_PARAMS_REQUEST:
- sec_params_request_process(&(p_ble_evt->evt.gap_evt));
- break;
- #ifdef BLE_GAP_ROLE_PERIPH
- case BLE_GAP_EVT_SEC_INFO_REQUEST:
- sec_info_request_process(&(p_ble_evt->evt.gap_evt));
- break;
- #endif
- #if PM_CENTRAL_ENABLED
- case BLE_GAP_EVT_SEC_REQUEST:
- sec_request_process(&(p_ble_evt->evt.gap_evt));
- break;
- #endif
- case BLE_GAP_EVT_AUTH_STATUS:
- auth_status_process(&(p_ble_evt->evt.gap_evt));
- break;
- case BLE_GAP_EVT_CONN_SEC_UPDATE:
- conn_sec_update_process(&(p_ble_evt->evt.gap_evt));
- break;
- };
- }
- #endif
|